Introduction to malware scanning

Malware scanning in Microsoft Defender for Storage improves the security of your Azure Storage accounts by detecting and mitigating malware threats. It uses Microsoft Defender Antivirus (MDAV) to scan your storage content, helping ensure data security and compliance.

Defender for Storage offers two types of malware scanning:

• On-upload malware scanning: Scans blobs automatically when they're uploaded or modified, providing fast detection. This type of scanning is ideal for applications that involve frequent user uploads, such as web applications or collaborative platforms. Scanning content as it's uploaded helps reduce the risk of malicious files entering your storage environment and propagating downstream.

• On-demand malware scanning: Lets you scan existing blobs and files whenever needed. You can scan either the entire storage account or targeted items such as a single blob, a specific container, or objects that match a path prefix. Use this scanning type to establish a security baseline for stored data, respond to security alerts during incident response, support compliance requirements, and perform targeted security investigations.

These scanning modes help you protect your storage accounts, meet compliance needs, and maintain data integrity.

Note

Scan durations can vary based on file size, file type, service load, and storage account read latency. Applications dependent on scan results should account for possible variations in scan times.

Why malware scanning is important

Content uploaded to cloud storage can introduce malware and create security risks. Malware scanning helps prevent malicious files from entering or spreading within your environment.

Key benefits include:

• Detecting malicious content: Identifies and mitigates malware.
• Enhancing security posture: Adds a layer to prevent malware spread.
• Supporting compliance: Meets regulatory requirements.
• Simplifying security management: Provides a cloud-native, low-maintenance solution configurable at scale.

Key features

Malware scanning includes the following key capabilities:

• Built-in SaaS solution: Simple to enable with zero infrastructure maintenance.
• Advanced antimalware capabilities: Uses MDAV to detect polymorphic and metamorphic malware for all file types.
• Comprehensive detection: Scans all file types, including archives like ZIP and RAR files, up to 50 GB per blob and file.
• Flexible scanning options: Provides both on-upload and on-demand scanning.
• Security alerts: Generates detailed alerts in Microsoft Defender for Cloud.
• Automation support: Integrates with Logic Apps, Function Apps, and Azure Event Grid to create automated responses to scan results.
• Compliance and auditing: Logs scan results for audit and compliance requirements.
• Private endpoint support: Supports private endpoints, reducing public internet exposure.
• Automated malware remediation: Soft-deletes malicious blobs detected through on-upload and on-demand malware scanning.

Choose the right scanning option

Use on-upload malware scanning if you need protection against malicious uploads—ideal for web applications, user-generated content, partner integrations, or shared content pipelines. For more information, see On-upload malware scanning.

Use on-demand malware scanning when you need scanning flexibility, for establishing security baselines, responding to alerts, preparing for audits, investigating a specific suspicious blob or file, or verifying stored data before archival or exchange. You can scan the entire storage account or use filters to target specific items. For more information, see On-demand malware scanning.

Malware scan results

You can access malware scan results through four methods. After setup, you see scan results as blob index tags for every scanned file, and as Microsoft Defender for Cloud security alerts when a file is identified as malicious. You can choose to disable the use of blob index tags in the Azure portal or through the REST API. You can also configure more scan result methods, such as Event Grid and Log Analytics, which require extra configuration.

The following sections describe each method in more detail.

Blob index tags

Blob index tags provide searchable key-value attributes on blobs. By default, Defender for Storage writes malware scan results to two index tags on every scanned blob:

• Scan result: No threats found, Malicious, Error, or Not scanned
• Scan time (UTC)

You can choose to disable the use of blob index tags in the Azure portal or through the REST API.

Blob index tags are designed to provide concise scan results for quick filtering and automation scenarios. Index tags aren't tamper-resistant. Users with permissions to modify tags can alter them, so you shouldn't use them as a sole security control. For security-sensitive workflows, use alerts, Event Grid events, or Log Analytics instead.

Note

Access to index tags requires appropriate permissions. For details, see Get, set, and update blob index tags.

Defender for Cloud security alerts

When a malicious file is detected, Defender for Cloud generates a security alert. These alerts include details about the file, the type of malware detected, and recommended investigation and remediation steps.

Defender for Cloud security alerts are useful for investigation and automated response. You can:

• View security alerts in the Azure portal by going to Microsoft Defender for Cloud > Security alerts.
• Configure workflow automations to trigger remediation actions when alerts are generated.
• Export security alerts to a Security Information and Event Management (SIEM) system. You can continuously export alerts to Microsoft Sentinel using the Microsoft Sentinel connector, or to another SIEM of your choice.

For more information about responding to security alerts, see Subscribe to custom topic.

Event Grid events

Event Grid provides near-real-time delivery of malware scan results for event-driven automation. This method is optional and requires more configuration, but it offers the fastest way to trigger automated responses based on scan results.

Event Grid supports several endpoint types for processing events, including:

• Function Apps: Run serverless code to move, delete, quarantine, or process scanned files.

• Webhooks: Notify external applications or services.

• Event Hubs and Service Bus queues: Forward scan result events to downstream consumers or processing pipelines.

Use Event Grid when you need low-latency, automated workflows that react immediately to malware scan results. Learn more about setting up Event Grid for malware scanning.

Log Analytics

Log Analytics provides a centralized, queryable repository for malware scan results. This method is optional and requires more configuration, but it's ideal for compliance, auditing, and historical investigations where detailed records of scan results are needed.

When you enable Log Analytics, the solution writes every malware scan result to the StorageMalwareScanningResults table in the configured Log Analytics workspace. You can query this table to review scan outcomes, investigate patterns, or generate compliance reports.

Use Log Analytics for creating an audit trail or performing in-depth analysis. For low-latency automation, use blob index tags or Event Grid instead. Learn more about setting up logging for malware scanning.

Tip

Explore malware scanning end-to-end through the Defender for Storage hands-on lab in the Defender for Cloud Ninja training.

Automated malware remediation

Malware scanning supports automated responses so you can react to scan results immediately and consistently. You can build automations based on blob index tags, Defender for Cloud security alerts, or Event Grid events, depending on your workflow requirements.

Common response patterns include:

• Enabling built-in soft deletion for malicious files, so detected malware is automatically moved or deleted without requiring custom workflows.

• Blocking access to unscanned or malicious files by using Attribute-Based Access Control (ABAC).

• Deleting or moving malicious files to a quarantine location by using Azure Logic Apps triggered by security alerts, or Function Apps triggered by Event Grid events.

• Forwarding clean files to another storage location by using Event Grid with Function Apps.

Learn more about setting up response actions for malware scanning.

Resources deployed by malware scanning

When you enable malware scanning, Defender for Storage automatically deploys several Azure resources required for scanning operations:

• Event Grid System Topic: Created in the same resource group as the storage account. This system topic listens for blob upload events and triggers on-upload malware scanning. Removing this resource stops malware scanning from functioning.

• StorageDataScanner resource: Defender for Storage creates this managed service resource in your subscription with a system-assigned managed identity. The identity receives the Storage Blob Data Owner role so it can read blob data for malware scanning and Sensitive Data Discovery. Defender for Storage also adds the identity to the storage account's network access control list (ACL) rules to allow scanning when public network access is restricted.

• DefenderForStorageSecurityOperator resource (subscription-level enablement): Defender for Storage creates this resource when you enable malware scanning at the subscription level. This identity configures, repairs, and maintains malware scanning settings for existing and newly created storage accounts. It includes the required role assignments to perform these operations.

These resources are required for malware scanning to function. If any of them are deleted or modified, malware scanning might stop working.

Note

If malware scanning stops working because of missing resources or permissions, disable and re-enable the feature to recreate and restore its required components.

Supported content and limitations

Supported content

Malware scanning supports the following content types and sizes:

• File types: All file types are supported, including compressed archives such as ZIP and RAR files.

• File size: You can scan blobs and files up to 50 GB.

Limitations

Be aware of the following limitations when using malware scanning:

• Unsupported storage accounts: Legacy v1 storage accounts aren't supported.

• Unsupported services: On-upload malware scanning isn't supported for Azure Files.

• Unsupported blob types: Append blobs and page blobs aren't supported.

• Unsupported client-side encryption: Client-side encrypted blobs can't be scanned, as the service can't decrypt them. Blobs encrypted at rest with Customer Managed Keys (CMK) are supported.

• Unsupported protocols: Blobs uploaded using the Network File System (NFS) 3.0 protocol aren't scanned.

• Blob index tags: Index tags for storage accounts with hierarchical namespaces enabled (Azure Data Lake Storage Gen2) are available in public preview. To use this feature, opt in to Blob Tags for Hierarchical Namespace.

• Unsupported regions: Not all regions currently support malware scanning. For the latest list, see Defender for Cloud availability.

• Event Grid: Event Grid topics that don't have public network access enabled, for example, those using private endpoints, aren't supported for scan-result delivery.

• Metadata update timing: If a blob's metadata is updated soon after upload, on-upload scanning might fail. To avoid this failure, either specify metadata in BlobOpenWriteOptions or delay metadata updates until scanning completes.

• Scan time limits: Large or complex blobs might exceed Defender's scanning timeout window, which ranges from 30 minutes to 3 hours depending on blob size and structure. For example, ZIP files with many nested entries typically take longer to scan. If a scan exceeds the allotted time, the result is marked as Scan timed out.

Performance and cost considerations

Blob scans and impact on IOPS

Each malware scan performs an extra read operation and updates blob index tags. These operations generate extra I/O but typically have minimal impact on storage performance (IOPS). Access to the scanned data remains unaffected during scanning, and applications can continue reading or writing to the blob without interruption.

You can reduce the IOPS impact by disabling blob index tags for scan-result storage.

Additional costs

Malware scanning might incur extra costs from dependent Azure services, including:

• Azure Storage read operations
• Azure Storage blob indexing, if you use index tags
• Event Grid events

Use the Microsoft Defender for Storage Price Estimation dashboard to estimate end-to-end costs.

Scenarios where malware scanning is ineffective

While malware scanning provides broad detection capabilities, certain data patterns or upload scenarios prevent the service from accurately identifying malware. Consider these cases before enabling malware scanning on a storage account:

• Chunked data: Detection might fail when you upload a file in fragments. The service marks header-only fragments as corrupt, while tail-only fragments might appear benign. Scan data before chunking or after reassembly to ensure coverage.

• Encrypted data: Malware scanning doesn't support client-side encrypted data. The service can't decrypt this data, so any malware within these encrypted blobs goes undetected. If encryption is required, scan data before encrypting it, or use supported encryption-at-rest methods such as customer-managed keys (CMK), where Azure Storage handles decryption for access.

• Backup data: Backup files might contain fragments of previously scanned or malicious content. Because the scanner evaluates the fragment itself rather than the original file context, backups might generate alerts even though the backup file as a whole isn't malicious.

Evaluate these scenarios as part of your threat model, particularly if untrusted or user-generated content can be uploaded to the storage account.

Detection differences between storage and endpoint environments

Microsoft Defender for Storage uses the same anti-malware engine and signature updates as Microsoft Defender for Endpoint. However, when you scan files in Azure Storage, you don't get certain contextual metadata that's available on endpoints. This lack of context can result in a higher likelihood of missed detections (false negatives) compared to scanning on an endpoint.

Examples of missing or unavailable context include:

• Mark of the Web (MOTW): MOTW identifies files that originated from the internet, but this metadata isn't preserved when files are uploaded to Azure Storage.

• File path context: Endpoint scanning evaluates the file path to determine whether a file is interacting with sensitive system locations, such as C:\Windows\System32. Blob storage doesn't provide equivalent path-based context.

• Behavioral data: Defender for Storage performs static analysis and limited emulation but doesn't observe runtime behavior. Some malware only reveals malicious behavior during execution and might not be detected through static inspection alone.

Access and data privacy

Data access requirements

To scan data for malware, the service requires access to the blobs in your storage account. When you enable malware scanning, Azure automatically deploys a resource named StorageDataScanner in your subscription. This resource uses a system-assigned managed identity and is granted the Defender for Storage Data Scanner role to read and scan data.

If your storage account is configured to allow public network access only from selected virtual networks or IP addresses, the StorageDataScanner resource is added to the Resource instances section of the storage account networking configuration. This configuration ensures the scanner can access your data even when public network access is restricted.

Data privacy and regional processing

Malware scanning handles data privacy and regional processing as follows:

• Regional processing: Malware scanning is performed in the same Azure region as your storage account to support data residency and compliance requirements.

• Data handling: The service doesn't store scanned files. In limited cases, the service might share file metadata such as the SHA-256 hash with Defender for Endpoint for further analysis.

Handle false positives and false negatives

False positives

A false positive occurs when a benign file is incorrectly identified as malicious. If you believe a file was incorrectly flagged, take the following actions:

• Submit the file for reanalysis.

  Use the Sample Submission Portal to report a false positive.

  When you submit, select Microsoft Defender for Storage as the source.

• Suppress repeated alerts.

  Create alert suppression rules in Defender for Cloud to reduce noise from recurring false positive alerts in your environment.

Address undetected malware (false negatives)

A false negative occurs when a malicious file isn't detected. If you believe malware was missed, submit the file for analysis through the Sample Submission Portal. Provide as much context as possible to support why you believe the file is malicious.

Note

Reporting false positives and false negatives helps improve detection accuracy over time.

Related malware scanning content

For more information about malware scanning options, see the following resource:

• On-upload malware scanning in Microsoft Defender for Storage

Next step

On-demand malware scanning in Microsoft Defender for Storage